Compromising the Secure Boot Process

Researchers discovered that the private platform key underpinning Secure Boot was published (in encrypted form) in a public GitHub repository and was cracked because it was protected by a four-character password; the leaked/test keys were included in production firmware across more than 200 device models from numerous major vendors, effectively compromising Secure Boot as a security guarantee.